Posted
by
EditorDavid
on Saturday October 22, 2016 @10:34PM
from the jailbreaking-and-entering dept.

An anonymous Slashdot reader quotes the Daily Herald:
Investigators in Lancaster, California, were granted a search warrant last May with a scope that allowed them to force anyone inside the premises at the time of search to open up their phones via fingerprint recognition, Forbes reported Sunday. The government argued that this did not violate the citizens' Fifth Amendment protection against self incrimination because no actual passcode was handed over to authorities...

"I was frankly a bit shocked," said Andrew Crocker, a staff attorney at the Electronic Frontier Foundation, when he learned about the scope of search warrant. "As far as I know, this warrant application was unprecedented"... He also described requiring phones to be unlocked via fingerprint, which does not technically count as handing over a self-incriminating password, as a "clever end-run" around constitutional rights.

I only ise my middle finger for authentication. There is no chance I would cooporate with a fucking search like this.

Actually, that's close to a good idea... one finger print that might nuke a selected data set while opening the actual phone app for a call (like when you answer without unlocking), others that would open the phone like normal. If they are not requiring you to turn over self-incriminating evidence then they could hardly claim you took an action that destroyed the non-evidence they want you to not hand over... I think that's it.. it's very confusing not confusing...

That could make you liable for obstruction of justice/evidence tampering if they forensically determined that your phone was programmed to delete information in such a manner. It wouldn't matter whether that information was incriminating or not, you'd still get busted, and could face at least a few years of prison time.

It would be better to just have a certain finger trigger your phone to reboot, thus requiring a password to decrypt the disk contents. They're pretty much SOL at that point since it then comes down to the "what you know" authentication factor, and "what you know" is constitutionally protected information, unlike the "who you are" authentication factor, which is what a fingerprint is, and the government can always compel you to identify "who you are" with probable cause or a search warrant.

Well, if you see them coming in demanding everybody unlock their phones, just quickly take it out, unlock it and turn it off. Takes about 3 seconds. Then when they get to you, it's too late because the phone will now require a password which you don't have to give.

Seriously, this is such an unconscionable violation of basic privacy that even people who have done nothing wrong should automatically have that reaction. And anybody who has done something wrong should know better than to use a fingerprint for unlocking anyway. What was this supposed to prove other than that they have a judge who will rubber-stamp any order no matter how appalling?

And anybody who has done something wrong should know better than to use a fingerprint for unlocking anyway.

That is so severely misinformed. Prisons are full of people who made simple mistakes, who should have "known better" than to leave some particular bit of evidence.

What was this supposed to prove other than that they have a judge who will rubber-stamp any order no matter how appalling?

Actually its probably far more complicated than you suggest. Obtaining a fingerprint from a *suspect* is something that is well established in law. The fact that fingerprints can now be used to unlock certain information does not somehow undo the long established precedent of fingerprint collection and use. While it may be a novel interpretation of "use" its a bit hysterical to characterize it as rubber stamping. Its more a mundane example of the law not keeping up with technology and needing to be updated: that fingerprint use with respect to identification is not self incriminating, but fingerprint use with respect to unlocking is self incriminating. The current law may simply not address the difference and simply refer to use with characterizing the use. If so the failure is in the legislature not necessarily the judiciary.

The phone is already full of finger prints, including the one on the fingerprint reader. All you need to recover it is sticky tape or cyanoacrylate, make a rubber molding and apply it again to the sensor. Fingerprints are a schtoopidttt way to lock a phone. It is like leaving the key under the doormat.

We have very little information to go on. I'd like to read the actual warant and know the cirumstances, but based on the article it seems like a violation of the FOURTH amendment. The cops are supposed to have a warrant, based on probable cause, describing what particular things they are searching for and where, and why they think those things are in that place.

I can't imagine a probable cause to believe that everyone in the building has some specific evidence on their phone. Thus the search itself is unconstitutional under the fourth, with or without a fingerprint.

The fifth says you don't have to testify against yourself. It doesn't say you can't be fingerprinted. Thus I see no *fifth* amendment violation, though it seems like a rather onerous *fourth* amendment violation.

However, they don't take your fingerprint and use that information to unlock your phone. They instead compel you to interact with a device. The question for the appellate court (and then supremes) will be whether this is compulsion of a testimonial act.

The fifth says you don't have to testify against yourself. It doesn't say you can't be fingerprinted

Let's say I agree to be fingerprinted. That means I'll let them put the ink on my fingers and I'll press my fingers against the paper sheet. Good. Now they are free to try using that paper (or a digital scan of that, or whatever) to unlock my phone.

It's actually both 4th and 5th. You can refuse to give up a password under the 5th amendment, since it can be self-incrimination. 4th amendment, because it is illegal search and seizure. The warrant issued here flies in the face of the 4th amendment, and could potentially violate someone's 5th amendment rights.

This isn't a loophole, this is a violation of the constitution. The judge who OK'd this, and the feds that performed the search should all be sent packing, and possibly serve jail time.

> Surely a fingerprint taken for identification purposes is personal information, solely taken for that purpose. There are (at least in principle) increasing controls for the use of personal information and I can't see why a fingerprint taken for this purpose could be legitimately used elsewhere.

I think the "could be legitimately used" part depends very much on a proper warrant showing probable cause.

Suppose you leave your set of keys with a locksmith, for the purpose of getting copies made. The police

(...) even people who have done nothing wrong (...). And anybody who has done something wrong should (...)

The problem is that everyone has some something wrong. There is some kind of law, statute or rule that you broke... or didn't follow strictly.This day and age there are so many rule, such broad law, that everyone had some something. Even if it as minor as jaywalking. Or driving over the speed limit for a couple minutes. Or parking a little too far from the sidewalk. Or something else completely different that in a given place is a misdemeanor.

I'm not screaming "evil big government here". I'm actually a law student and an intern in a attorney office. We all break some law several times every day. But these are such minor things that the legal system simply don't care. Maybe it is not a criminal law, but only enough for a civil lawsuit. But we are still breaking the rules.

In the eyes of the law, no one is 100% guiltless, even if they are innocent.

This is one of the problems why the legal system doesn't work. We punish too many things, so we punish badly. And, in that scenario, when the policing forces (local, state or federal) get increased powers and broader mandates, they get carte blanche to so pretty much what they want to anyone they want. After all, everyone is guilty of something.

(...) even people who have done nothing wrong (...). And anybody who has done something wrong should (...)

The problem is that everyone has some something wrong. There is some kind of law, statute or rule that you broke... or didn't follow strictly.This day and age there are so many rule, such broad law, that everyone had some something. Even if it as minor as jaywalking. Or driving over the speed limit for a couple minutes. Or parking a little too far from the sidewalk. Or something else completely different that in a given place is a misdemeanor.

I'm not screaming "evil big government here". I'm actually a law student and an intern in a attorney office. We all break some law several times every day. But these are such minor things that the legal system simply don't care. Maybe it is not a criminal law, but only enough for a civil lawsuit. But we are still breaking the rules.

In the eyes of the law, no one is 100% guiltless, even if they are innocent.

This is one of the problems why the legal system doesn't work. We punish too many things, so we punish badly. And, in that scenario, when the policing forces (local, state or federal) get increased powers and broader mandates, they get carte blanche to so pretty much what they want to anyone they want. After all, everyone is guilty of something.

Things are only getting scarier.

"Give me 6 folders of porn from the most innocent of men and I shall find something in there to hang him."

In some places it might be porn with wrinkled 60 year old women in school uniforms. In other places, porn featuring women whose breasts are too small.

One thing that/. users don't get is that while that may seem obvious to you, it's not obvious to everyone. That's why the law and regulations are constantly in search of trying to balance citizens from having to be experts about everything they buy/own/need. And the time honoured thought of "oh, only idiots will not do this, and idiots are people who deserve what happens to them" plays nicely into the hands of a dysfunctional society. If you have a "just world" mentality, that things happen to people *because* they deserve it, you may not get out enough.

Donald Trump is an anti tyrant. He's more like a little boy who has no idea what to do or how to do it.

Actually, I'm pretty sure Donald Trump has "ideas" about "what to do." He's pretty famous for them. They may be wacky or unrealistic or even impossible, but he has ideas. Some of which could have major political ramifications if he even attempts to follow through.

Anyhow, I think you may not realize that "tyrants" in world history take many forms. Relatively few of them throughout history started out as clear "twirling the mustache" evil dudes who had a Machiavellian plan to become a "tyrant." Much more common are situations where you take a somewhat average guy, put him in a leadership position, create some tough choices, and watch him choose the bad ones. A lot of "tyrants" throughout history very gradually slipped into tyranny, often with the support of the public along the way, cheered along by their fears and promises of "security" from a well-meaning leader.

You know what prevents that sort of thing? Knowledge. Knowledge of history. Knowledge of politics. Realizations that paths others have taken before have led to badness. History has shown again and again that the most ignorant "nice" folks who end up leadership positions can turn out to be the worst... they don't know any better, so they can be swayed into all sorts of bad acts.

And Donald Trump doesn't even have that "niceness" to go along with his ignorance.

In some ways having a child who doesn't understand politics at the top of what is shown to be an institutionalised assault on the rights of all may actually be a good thing.

Maybe. Or it could be even a faster track to a dictatorship. The problem is that it's completely unpredictable.

None of this should be viewed as an argument in favor of Clinton, who is also a terrible candidate. But acting like things are likely to be better because Trump is an "outsider" and less corrupt (at least by the political establishment) is just not a safe bet.

Yup, we are better off with Hillary, who 'acts' nice, that is better than being one's self. And we are less vulnerable to tyranny with Hillary even though the media will send her message for her, she can lie about stuff and get away with minimal scrutiny by the mainstream media. She can cover up her tracks and get the FBI to cut a deal to allow her underlings to destroy evidence with no ramifications. She has a powerful political party AND money machine behind her.

Like various other historical figures, Trump will fire up the masses to such an extent that the political class can't do anything else but go along with him or lose their jobs in 2018. The tea party types are primed and ready to go. He would be the president- what's to stop him from doing daily 3 hour news conferences where he spews nonsense and vitriol? He has been on TV doing that exact thing. Two years of "trust me, they are stopping me from making you all millionaires" and he could easily turn congr

Where do you think tyrants cone from? They are always immature little boys with no sense if actual fairness of empathy.

Tyrants come from the ability to tap into unchecked power. The president of the united states is often a hamstrung puppet. Tyranny in the USA comes from the institution itself including congress and the supreme court who have shown time and time again to not represent the American people as much as their corporations.

Would you give a teenager a nuke? That is what will happen when people vote for trump.

There's a difference between Kim Jong Il with a nuke and Trump with a nuke. The former is a Tyrant. His decision to start a nuclear war would be unopposed, unchecked and supported in general. T

They may well be charged with treason, however I think you will find that very few military commanders who are authorised to issue nuke launch codes will actually do so even on a presidential order.

The Rand institute studied this in the 1980s, based on 1970s military battlefield simulations. Nuke-capable commanders only ever used them in _one_ simulation and in all subsequent runs they'd surrender rather than use them - even if the other side tossed them first.

Easier to implement then that. Iris scan is already a working technology, as is eye-following so you could just look at dots in a pattern in sequence to unlock your phone. At which point, it's back to them compelling you to type in a passcode in order to unlock the phone.

Imagine, going to sit down at a computer, and small, very short range, wireless signal authenticates you to the computer, unlocks your email, etc.

Welcome! The future is here! That is exactly what happens when I sit down at my locked Macbook (running Sierra) while wearing my Apple Watch; the laptop and watch exchange a key, and my laptop unlocks.

Actually, that is now past tense; thanks to this story (and others I've read recently), I have turned this feature off. It's clever and convenient, but not worth the risk of getting inadvertently swept up in some overzealous search warrant issued by a lazy and/or technologically-ignorant judge.

If your turn your phone off/reboot the moment the police turn up it means you can't film them with it. So you have to choose between filing and risking them grabbing it, or protecting your privacy.

Phones need a panic button. Say tap the power button three times quickly and it goes into a locked down mode where it records video as long as you hold the volume button down, and the moment you let go it reboots and all data is safety encrypted.

It isn't 100% clear, there is no cut and dried supreme court ruling and there have been some conflicting lower court rulings but in general the opinion of the courts seems to be that you can't be forced to hand over a password/code/etc because that is something in your head, which falls under 5th amendment protections against self incrimination.

The 4th amendment is what would be used to challenge a broad search warrant like was issued in this case. Without knowing the specifics I can't say for sure but this sounds like it would be an illegal search since it was a general warrant and that isn't allowed. The police aren't (supposed to be) able to get a warrant to just search anyone or anything in a given place, they have to be specific. This doesn't sound like it was, and so would probably be a 4th amendment violation.

It's been said countless times here. Requiring both a fingerprint and a passcode would have protected phone owners from this fishing expedition.

As for the greater ramifications of the unprecedentedly broad warrant that was issued, well, I'm glad I'm not a US citizen and don't live there. And I'm increasingly reluctant to travel there as well, precisely because of things like this. America has become a scary, scary place.

As for the greater ramifications of the unprecedentedly broad warrant that was issued, well, I'm glad I'm not a US citizen and don't live there. And I'm increasingly reluctant to travel there as well, precisely because of things like this.

You're kidding right? The USA has shown itself as of late to have nothing going for it. Freedoms no longer exist, due process no longer exists, it's not the best place for education, health, the division of wealth is simply staggering compared to many other countries, and the chicks in Sweden are far hotter.

"...and the judge who issued the warrant isn't qualified to practice law..."

Note the very careful wording, both in the Warrant, (Which has yet to surface...), and the reporting about it. There is far more to this case than appears.-No _person_ was charged or implicated either before or after the Warrant was issued and served. The Judge has not been named.-The reason(s) for obtaining the Warrant has not been released.-One witness has come out and expressed confusion; she claims not to know why she was ordered to comply. No explanation was given to her, and she has witnesses to this.

This seems to be a Fishing Expedition gone horribly wrong, and the Judge isn't the only one who is blameless. Somebody wanted very much to have this happen, most likely for "National Security" reasons. (Unpaid Parking Tickets seems unlikely, at least for now.) And indeed if that is the case, we may never know any more. The Law Enforcement Industry likes to keep mum on their screwups.

Too much attention is being paid to the How, and not enough people are asking Why?

If it's so obvious I'm keen to hear your analysis of why. After all there are several here who say that it's not a violation of the fifth at all, and a least one post shows it's more likely a violation of the fourth.

It's more like you had a party at your house with 50 people, and the police got a warrant to search your house,that included a clause "allowing" them to search the fingerprint-protected safe of any person who was at your party

scope that allowed them to force anyone inside the premises at the time....

Contrast that against the Fourth amendment's requirements:

supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

Note that the constitution requires that warrants describe particular people or things.

It's Unconstitutional and Illegal/violation of the supreme law of the land to have a "generic search" or a "generic warrant document"allowing police to search and seize or disseminate the personal property of ANY random person they happen to find at place X.

The constitution requires they have made a specific list of people to search people, or a specific list of things to search objects not in peoples' personal affects.

Exactly. Unless you have my name on your warrant and have a reasonable suspicion backing that warrant, you can do a cursory safety check and then go fuck yourself. I'm not doing anything wrong and I live in a country where I don't have to prove that. And for what it's worth, every police officer I've counted as a friend hates this kind of fascist crap.

supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

You are reading way too much into this. If the police get a warrant to search a particular house for drugs that is a specific warrant. If it were all houses or to search for any contraband that would be a general warrant and unconstitutional. When they exercise that warrant they're going to search the whole house with everyone's belongings, they don't have to go through the coat rack and assign ownership first then come back with one warrant for Alice's jacket, one for Bob's jacket and not search Eve's jack

They couldn't force you with out the lead pipes and rubber hoses, fortunately those aren't allowed in the US yet. What you do in a situation like this is refuse to comply, force them to arrest you and spend the night in jail so you can call the ACLU and get the warrant tossed.

See they get away with it because no one refused to comply. Once everyone in the building complies there is no effective way to sue them and set a precedent that will stop this happening again. When they arrest you they move the warrant to the next stage and you now have grounds to sue them over the warrant that you don't have if you comply.

Sometimes standing up to illegal orders is hard, including being arrested hard. Know your rights and refuse illegal orders like this (yes I recognize the warrant was technically legal because it hadn't been challenged). Then use the arrest to go after them and make sure it never happens again.

So, effectively ruin your life? By doing that, you not only get into databases that you might have had some chance avoiding otherwise, you also fuck over your chances of ever having a decent job again (unless you happen to be in a career such as activist or journalist where getting arrested is respected instead of condemned). HR departments are too stupid and lazy to know or care about the difference between getting arrested because you're a criminal and getting arrested because the police are criminals.

In the totalitarian police state of America, it's injustices all the way down.

They went in and searched everyone's phones. Unless there's an important detail we aren't being told here, that's unconstitutional. The 4th amendment says "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

Fingerprints are an inherently insecure way to 'secure' a device of any kind because there are techniques to obtain latent fingerprints, which we all leave everywhere anyway, and use them to make a replica fingerprint which will open devices, security doors, phones, whatever, which is supposedly secured by said prints.

If you secure anything with fingerprints as your sole method of security, you have accepted having no security. It's a really bad way to secure anything unless you just don't care.

A normal search warrant already gives the police the right to obtain those latent prints and, hell, make you submit to fingerprinting on the old ink pad or the new electronic scanners. The same warrant also gives them the right to seize the devices that they wish to open.

Apparently the cops think they don't have the right to go through the steps to make a replica print and get the device to open. They are manufacturing something rather than just looking at the evidence. Personally I don't see a hill of difference here between that need and a police raid that seizes a padlocked box for which the police are unable to find a key. They would get a locksmith to open it, or more likely, cut the lock. So you have a locked phone. Make a replica print. Done.

This fingerprint warrant just sounds like they didn't want to spend time on doing it the hard way. Or they were after something else.

you're right, but in this case, it's my opinion the local cops are a bunch of stooges. they have no clue. the local prosecutor, same.
It doesn't help when the reason local law enforcement can't deal with it because they're stupid.

caveat. I know a lot of talented people in the law enforcement side, whom I respect immensely. this is a bad apple problem.

This totally illegal general warrant/search is just too far beyond the pale and smells like a panic move by someone in local LE and/or a local politician/bureaucrat who thinks they may have been caught doing something or being somewhere they shouldn't, but the only clue they had to the identity of the person with the possible evidence was seeing the person walk into this building they searched. Now, if this anonymous 'building' was a news/media outlet, it gets even juicier.

When first turned on, my Samsung phone won't unlock by fingerprint, it requires a passcode. Just turn your phone off upon seeing the warrant! Seems strange that they can compel a fingerprint but not a password.

It's probably the difference between something you have, and something you know. The first is covered by the search warrant (the right to search and look at everything - including the fingerprint), the second not (you're not required to give information, e.g. on where to find things - and the password).

You have 10 different fingers you can use to fingerprint-lock your phone. Most phones lock up after 5 tries. Can they compel you to use the correct finger? How many times can they force you to try and fail before it is effectively unlawful detention?

I want a "panic" finger such that it displays a "could not read fingerprint - try again" message and then immediate sets "allow_unlocking_with_fingerprint=False" internally so that a password is required. Make it indistinguishable from the usual unlock failure message so that it's impossible to tell that it was triggered (even by examining the on-device logs, if that's possible).

"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."
The color of law seems to device power on requested at a boarder crossing or internal boarder checkpoint to affirm citizenship.
The really bad news is in the network information

It came down to whether on not an affirmative action was required on the part of someone, or if it was a non-affirmative action. Use of a key on a safe or lockbox is not affirmative. Being forced to enter the combination is not affirmative; it's tantamount to compelled testimony.

Here's the part of the decision of interest:

A defendant can be compelled to produce material evidence that is incriminating. Fingerprints, blood samples, voice exemplars, handwriting specimens, or other items of physical evidence may be extracted from a defendant against his will. But can he be compelled to use his mind to assist the prosecution in convicting him of a crime? I think not. He may in some cases be forced to surrender a key to a strongbox containing incriminating documents, but I do not believe he can be compelled to reveal the combination to his wall safe —- by word or deed.

Moral of this story: use a pin code, rather than using the fingerprint unlock. It may be a cool feature, but it offers you no legal protection.

There are clauses written into the recent, secretly-drafted international trade agreements (like TTIP and CETA) which allow a commercial company to sue the government of any signed-up nation, if that government acts in a way that harms the profits of the company. Yes, this is totally retarded, but then that's what you get when you allow companies to write laws.

Just wondering, however, if any legislation like this already exists in the United States? Companies like Apple might be able to use it against an

The one thing the Founders wanted to guard against was general warrants. This warrant gets pretty close to being one. It was limited to a specific building, but next time it could be limited to a specific block, or even a specific city or county. I think they're building precedent for doing such things. If they get away with this one, then what's to stop them from going further?

I see a lot of people here who are repeating the "why would you use fingerprints for authentication when your fingerprints can just be lifted off of any nearby surface?!" line, which is ignorant of how fingerprint scanners in modern cell phones actually work. Read up on it a bit: http://www.androidauthority.com/how-fingerprint-scanners-work-670934/ [androidauthority.com]

The short version is that no, the police will not be able to fool your phone's fingerprint scanner by using a print collected off of something else you've touched. Modern scanners do not record visual images of your fingerprint and match against that; they measure either changes in capacitance associated with the ridges of your finger touching the phone or your finger's response to an ultrasonic pulse. Both forms are incredible hard to fool with a prosthetic (and probably won't even work if your finger has been severed, although I don't know if anybody's tested that).

Absolutely right. Most alarm systems have a "Panic" code which appears to disarm the alarm, but in fact sends out a panic signal and notifies the cops. A "self-destruct" finger print would be in the same vein.